Subject: Patch for passive mode in Beta13

From: [email-masked] (Pedro Melo)
Date: Wed, 26 Mar 1997 12:41:42 GMT

Hi!

Some time ago I made a patch for beta12 that allows you to restrict the
port ranges used by passive mode ftp. 

This is helpfull for people who dont want to open just a part of their port
space in their firewall.

So far, the pacth is compile time only. You cannot specify in the  config
file the port range to use. You have to change the values of PASSIVE_BASE
and PASSIVE_SPAN in the patched ftpd.c and recompile... For ex, if you want
to open ports 4000 to 5000, use PASSIVE_BASE 4000 and PASSIVE_SPAN 1000

Apply to the ftpd.c in the src directory...

I've been working with this patch for a coupple of month now, no problems.

*** ftpd.c.orig	Fri Mar 21 02:15:09 1997
--- ftpd.c	Fri Mar 21 02:19:00 1997
***************
*** 394,399 ****
--- 394,401 ----
      struct sockaddr_in *virtual_ptr;
  #endif
  
+     srandom(getpid());
+ 
  #ifdef AUX
      setcompat(COMPAT_POSIX | COMPAT_BSDSETUGID);
  #endif
***************
*** 3246,3251 ****
--- 3248,3256 ----
   * response by Jon Postel in a telephone conversation with Rick Adams on
25
   * Jan 89. */
  
+ #define PASSIVE_BASE 3000
+ #define PASSIVE_SPAN 500
+ 
  void
  #ifdef __STDC__
  passive(void)
***************
*** 3253,3259 ****
  passive()
  #endif
  {
!     int len;
      register char *p,
       *a;
  
--- 3258,3264 ----
  passive()
  #endif
  {
!     int len, bind_error;
      register char *p,
       *a;
  
***************
*** 3268,3281 ****
          return;
      }
      pasv_addr = ctrl_addr;
!     pasv_addr.sin_port = 0;
      delay_signaling(); /* we can't allow any signals while euid==0: kinch
*/
      (void) seteuid((uid_t) 0);		/* XXX: not needed if >
1024 */
!     if (bind(pdata, (struct sockaddr *) &pasv_addr, sizeof(pasv_addr)) <
0) {
!         (void) seteuid((uid_t) pw->pw_uid);
!         enable_signaling(); /* we can allow signals once again: kinch */
!         goto pasv_error;
      }
      (void) seteuid((uid_t) pw->pw_uid);
      enable_signaling(); /* we can allow signals once again: kinch */
      len = sizeof(pasv_addr);
--- 3273,3293 ----
          return;
      }
      pasv_addr = ctrl_addr;
! 
      delay_signaling(); /* we can't allow any signals while euid==0: kinch
*/
      (void) seteuid((uid_t) 0);		/* XXX: not needed if >
1024 */
!     do {
!         pasv_addr.sin_port = PASSIVE_BASE + random() % PASSIVE_SPAN;
!         if (log_commands) syslog(LOG_DEBUG, "PASV trying %d",
pasv_addr.sin_port);
!         bind_error = bind(pdata, (struct sockaddr *) &pasv_addr,
sizeof(pasv_addr));
!     } while(errno==EADDRINUSE);
!     if (bind_error < 0) {
!               (void) seteuid((uid_t) pw->pw_uid);
!               enable_signaling(); /* we can allow signals once again:
kinch */
!               goto pasv_error;
      }
+     if (log_commands) syslog(LOG_DEBUG, "PASV got %d",
pasv_addr.sin_port);
+ 
      (void) seteuid((uid_t) pw->pw_uid);
      enable_signaling(); /* we can allow signals once again: kinch */
      len = sizeof(pasv_addr);
--
************** Pedro Melo ([email-masked]) BOFH ******************
*   TELENET, Servicos de Telecomunicacoes, SA - Tel +351 1 3139190   *
* finger [email-masked] or search key servers for PGP key *
*           It's management's job to support the geniuses,           *
*                      not to tell them what to do                   *
**********************************************************************

---

From: [email-masked] (Stan Barber)
Date: Wed, 26 Mar 1997 09:15:17 CST

As we are in a code freeze and will not be adding more features until
the next release (after 2.4.2 is out), this will be held for consideration
at that time.

-- 
Stan   | Academ Consulting Services        |internet: [email-masked]
Olan   | For more info on academ, see this |uucp: {mcsun|amdahl}!academ!sob
Barber | URL- http://www.academ.com/academ |Opinions expressed are only mine.